Tech Challenge

A health startup publishes a "de-identified" research extract. It drops the name, email and national-ID columns and replaces the internal patient id with a fresh random UUID per row; the mapping table stays in-house. Every published row still carries exact date of birth, 5-digit ZIP code, sex and diagnosis. Legal signs off because "no direct identifier remains". Why is that reasoning wrong?

# published_extract.csv  (dropped: name, email, national_id)
patient_uuid,dob,zip,sex,diagnosis
0f7a1c9e-...-a91,1984-03-12,02139,F,Type 2 diabetes
b21e6d40-...-77d,1979-11-02,02139,M,Hepatitis C
5cc80b13-...-1e2,1991-07-25,94110,F,Major depressive disorder